From: Jan Beulich <jbeulich@suse.com>
Date: Wed, 21 Dec 2016 15:47:19 +0000 (+0100)
Subject: x86/HVM: add missing NULL check before using VMFUNC hook
X-Git-Tag: archive/raspbian/4.11.1-1+rpi1~1^2~66^2~3098
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/success//%22http:/www.example.com/cgi/success/?a=commitdiff_plain;h=74dcd0ce6f4fadce8093e54f0fc1a45426577e13;p=xen.git

x86/HVM: add missing NULL check before using VMFUNC hook

This is CVE-2016-10025 / XSA-203.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
---

diff --git a/xen/arch/x86/hvm/emulate.c b/xen/arch/x86/hvm/emulate.c
index 9da7336ce6..ecc107bc0a 100644
--- a/xen/arch/x86/hvm/emulate.c
+++ b/xen/arch/x86/hvm/emulate.c
@@ -1650,6 +1650,8 @@ static int hvmemul_vmfunc(
 {
     int rc;
 
+    if ( !hvm_funcs.altp2m_vcpu_emulate_vmfunc )
+        return X86EMUL_UNHANDLEABLE;
     rc = hvm_funcs.altp2m_vcpu_emulate_vmfunc(ctxt->regs);
     if ( rc != X86EMUL_OKAY )
         x86_emul_hw_exception(TRAP_invalid_op, X86_EVENT_NO_EC, ctxt);